US20220197915A1 - Dynamic entity visualization of search results - Google Patents
Dynamic entity visualization of search results Download PDFInfo
- Publication number
- US20220197915A1 US20220197915A1 US17/128,651 US202017128651A US2022197915A1 US 20220197915 A1 US20220197915 A1 US 20220197915A1 US 202017128651 A US202017128651 A US 202017128651A US 2022197915 A1 US2022197915 A1 US 2022197915A1
- Authority
- US
- United States
- Prior art keywords
- search
- graph
- search results
- display region
- node
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
- 238000012800 visualization Methods 0.000 title 1
- 230000004044 response Effects 0.000 claims abstract description 19
- 238000000034 method Methods 0.000 claims description 32
- 230000000977 initiatory effect Effects 0.000 claims description 8
- 238000004891 communication Methods 0.000 description 16
- 238000013459 approach Methods 0.000 description 7
- 238000011835 investigation Methods 0.000 description 7
- 230000005540 biological transmission Effects 0.000 description 5
- 230000003287 optical effect Effects 0.000 description 5
- 238000010586 diagram Methods 0.000 description 3
- 230000006870 function Effects 0.000 description 3
- 238000013500 data storage Methods 0.000 description 2
- 230000007246 mechanism Effects 0.000 description 2
- 230000008569 process Effects 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- RYGMFSIKBFXOCR-UHFFFAOYSA-N Copper Chemical compound [Cu] RYGMFSIKBFXOCR-UHFFFAOYSA-N 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 238000012937 correction Methods 0.000 description 1
- 230000008878 coupling Effects 0.000 description 1
- 238000010168 coupling process Methods 0.000 description 1
- 238000005859 coupling reaction Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 235000008409 marco Nutrition 0.000 description 1
- 244000078446 marco Species 0.000 description 1
- 230000006855 networking Effects 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2457—Query processing with adaptation to user needs
- G06F16/24578—Query processing with adaptation to user needs using ranking
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/904—Browsing; Visualisation therefor
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/901—Indexing; Data structures therefor; Storage structures
- G06F16/9024—Graphs; Linked lists
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/903—Querying
- G06F16/9038—Presentation of query results
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/953—Querying, e.g. by the use of web search engines
- G06F16/9535—Search customisation based on user profiles and personalisation
Definitions
- the present invention relates to software and, more specifically, to an application that generates a combined search and graph interface for facilitating investigative searches.
- Each investigative search is typically conducted as a series of searches, where the results of a prior search in the series may be used as the starting point of a subsequent search in the series. There are no limits to how deep or wide the series of searches may become. Consequently, the sheer amount of data obtained during the searches, and the relationships among such data, can be overwhelming to visualize, track and manage.
- investigative searches are performed by manually adding nodes to a graph that representing points of interest related to the investigation.
- graphs generated that represent the search often become extremely large, making the graphs difficult to manage and decipher.
- investigative searches are performed by searching through various data sources and manually recording navigational actions as a user branches through different data sources, such as webpages and documents.
- searching approach lacks visibility and makes it difficult for a user to interact with the search, such as by backtracking and branching from one data source to another.
- Techniques are desired to facilitate investigative searches in a scalable, efficient manner that allows investigators to visualize and interact with a search.
- FIG. 1 illustrates a combined search and graph interface that may be generated by a mobile or web application, according to an embodiment
- FIG. 2 illustrates the combined search and graph interface of FIG. 1 after a search result is selected from the search results, according to an embodiment
- FIG. 3 illustrates a close up view of the graph from FIG. 2 , according to an embodiment
- FIG. 4 illustrates a display of search results that result from initiating a search from a node of the graph shown in FIG. 3 , according to an embodiment
- FIG. 5 illustrates a combined search and graph interface rendered in response to a user selecting one of the search results shown in FIG. 4 , according to an embodiment
- FIG. 6 illustrates a display of search results with named entities, according to an embodiment
- FIG. 7 is a block diagram of a computer system upon which the techniques described herein may be implemented.
- each investigative search may involve a series of distinct searches, where a search result obtained by one search is used as the starting point for a subsequent search.
- the first search performed during an investigative search is referred to herein as the level-1 search.
- Any search initiated from any result of the level-1 search is referred to as a level-2 search.
- any search initiated from any result of a level-2 search is referred to herein as a level-3 search.
- the combined search and graph interface When a user initiates a level-1 search for a target, the combined search and graph interface concurrently displays a set search results for the level-1 search and a graph that includes a first node corresponding to the “target” of the level-1 search.
- the target of a search may be, for example, the keywords used to perform the search.
- a second node is added to the graph that represents the selected level-1 search result.
- the second node is displayed as directly connected to the first node in the graph.
- the selected level-1 search result corresponds to a data source that is associated with one or more named entities
- one or more child nodes that correspond to the one or more named entities are added to the graph.
- the selected level-1 search result is a user profile that includes four named entities: two email addresses, a user_id, and an IP address.
- four child nodes would be added below that second node, one for each of the four named entities extracted from the selected user profile.
- nodes that correspond to the user's search result selections are automatically added to the graph.
- a search can be initiated from any node that exists in the graph. For example, the user may select that node that corresponds to any of the four named entities that were extracted from the selected level-1 search result.
- a level-2 search can be initiated based on the named entity that corresponds to the selected node.
- the graph and a set of level-2 search results generated by the search are concurrently displayed in the combined search and graph interface.
- the combined graph and search interface discussed herein provides a simultaneous interleaving of search functionality and graph building.
- a user can interact with search results using the graph and/or the search interface while simultaneously recording the results of their investigation in the graph.
- the combined interface and associated functionality simplifies an investigation process by automatically recording navigational structure of a search into an easy-to-navigate and digestible graph.
- FIG. 1 it illustrates a combined search and graph interface that may be generated by a mobile or web application.
- a user is presented with a search bar 102 shown at the top of FIG. 1 , search results display region 108 shown on the left of FIG. 1 , and a graph display region 110 shown on the right of FIG. 1 .
- FIG. 1 also shows a data source selection 106 , shown below the search bar and a record button 104 shown to the left of search bar 102 .
- data source selection 106 can be used to select a data source for executing the search on.
- the search results display region 108 is populated with results of the search and a node is automatically added to the graph that represents the target of the search.
- “pimp_alex_91” is the target of the current search.
- the search results display region 108 shows search results corresponding to the search target “pimp_alex_91”.
- the graph display region 110 shows a graph that includes a single node corresponding to “pimp_alex_91”.
- Each search result of the search results display region 108 is displayed with a date and one or more name entities.
- Each named entity shown for a search result is extracted from a data source that corresponds to the particular search result.
- the search result titled “hostinguer.com” is associated with the named entities including “Name: alexander antibiotices”, “Ip: 74.56.48.43”, “Email: pimp_alex_91@hotmail.com” which are extracted from the “hostinguer.com” data source. Details regarding how named entities are extracted from data sources are further discussed herein.
- the graph display region 110 in response to performing a search, is not automatically populated with nodes for each of the search results. Doing so would cause the graph to become crowded and difficult to decipher. Further, a search may produce hundreds of search results, where only a few of those search results are of interest to the searcher. Thus, instead of automatically populating the graph with nodes for all search results, the user can select to explicitly “add to graph” a search result. Doing so will not only cause a node for that search result item to be added to the graph, but it will also cause a set of child nodes to be added to the graph, where the child nodes correspond to named entities extracted for the selected search result item.
- the selections made by the user are automatically recorded and visualized in the graph display region 110 .
- a node that represents the selected search result is created in the graph display region 110 .
- further search is performed based on the selected entity or link and the search results display region 108 is repopulated with the results of the further search.
- additional nodes are added to the graph display region 110 along with connectors that indicate relationships between nodes.
- the user may select a level-1 search result as the basis for a level-2 search.
- a level-1 search result titled “hostinguer.com”.
- a node is added to the graph display region 110 to represent the data source “hostinguer.com”, as illustrated in FIG. 2 .
- nodes are added to the graph display region 110 to represent the named entities (e.g. “Ip: 74.56.48.43”) that were extracted from “hostinguer.com”.
- the record button 104 can be used as a mechanism for controlling when user selections from the search results display region 108 are automatically added as nodes in the graph. In one embodiment, when the record button 104 is enabled, selections made from search results display region 108 are automatically added as nodes in the graph display region 110 . In one embodiment, when the record button 104 is disabled, selections made from search results display region 108 are not automatically recorded as nodes in the graph display region 110 . In one embodiment, even if the record button 104 is disabled, a user can manually add nodes to the graph display region 110 by selecting a search result from the search results display region 108 and commanding the interface to explicitly “add to graph” the selected search result.
- FIG. 2 it illustrates the combined search and graph interface of FIG. 1 when a search result is selected from the search results.
- the data source “hostinguer.com” is selected from the search results by a user.
- a node corresponding to the data source “hostinguer.com” is added to the graph.
- the search result “hostinguer.com” represents a data source and is associated with the named entities including “Name: alexander antibiotices”, “Ip: 74.56.48.43”, “Email: pimp_alex_91@hotmail.com”, a set of child nodes that correspond to the named entities are added to the graph.
- dotted lines between nodes in the graph may indicate indirect relationships (e.g. “produced the search result”) and the presence of a search result node.
- the dotted line between the node “pimp_alex_91” and the node “hostinguer.com” indicates that the node “hostinguer.com” is associated with a search result, and that the search result was found based on a search made using the target associated with the parent node, “pimp_alex_91”.
- solid lines between nodes in the graph may indicate direct relationships (e.g. “contains the named entity”).
- the solid line between the node “hostinguer.com” and the node “hotmail.com” indicates that the node“hotmail.com” is a named entity extracted from the data source node “hostinguer.com”.
- a level-(N+1) search can be initiated from any level-N node in a graph to continue an investigation of an entity.
- FIG. 3 it illustrates a close up view of the graph from FIG. 2 .
- the “Search” function is selected for the node “Alexandre malariaes”.
- the “Alexandre malariaes” node was a named entity node from the level-1 search result “hostinguer.com”.
- the ‘Search’ function is selected for a node, a level-2 search is initiated and the respective level-2 search results are displayed in the search results display area.
- a corresponding data source may automatically selected as a target data source for the level-2 search.
- a list of data sources may be curated by an administrator for each different type of entity. For example, if a Username entity type is selected for a search, the ‘Social Profiles’ data source is selected as the target data source for executing the search.
- FIG. 4 it illustrates a display of the level-2 search results that result from initiating a search from a node of the graph shown in FIG. 3 .
- FIG. 4 displays search results that result from the selection of the “Search” function for the node “Alexandre malariaes” as shown in FIG. 3 .
- the search results show results of the search target “Alexandre malariaes” in the target data source “Social Profiles”.
- FIG. 5 it illustrates a combined search and graph interface rendered in response to a user selecting one of the search results shown in FIG. 4 .
- the named entity “CazesAlexandre” 502 is selected by a user from the search results.
- a node that represents the named entity “CazesAlexandre” is automatically added to the graph.
- the graph shows the node “CazesAlexandre” directly connected to the node “Alexandre malariaes”.
- search results When a search is initiated and search results are retrieved from a data source, the resulting content of the search results is scanned for entities such as email addresses, usernames, names, phone numbers, etc. The identified entities are displayed prominently in association with the data sources of the entities in the search results.
- FIG. 6 it illustrates a display of search results with named entities.
- the search result “Untitled” that is represented by the hyperlink “http://pastebin.com/XJqmKp4k” is displayed with the named entities: ‘Marcos’, ‘Aberto Kuselman’, ‘Madison’, ‘Lucy Parsons’, ‘Colin Jenkins’, ‘Barack Obama’, ‘Keith Alexander’, ‘Trump’, ‘andl’.
- the named entities are extracted from the “Bins” data source using machine learning based techniques.
- named entities are ranked based on the relevance to the entity being investigated. Relevance scores may be generated that indicate a metric of relevance between a search target and named entity. In one embodiment, entities with higher relevance scores are displayed at the top of the search results to draw more attention. This minimizes the time taken by users to look for these entities in the search results.
- the combined graph and search interface discussed herein provides a simultaneous interleaving of search functionality and graph building.
- a user can interact with search results using the graph and/or the search interface while simultaneously recording the results of their investigation in the graph.
- the techniques described herein are implemented by one or more special-purpose computing devices.
- the special-purpose computing devices may be hard-wired to perform the techniques, or may include digital electronic devices such as one or more application-specific integrated circuits (ASICs) or field programmable gate arrays (FPGAs) that are persistently programmed to perform the techniques, or may include one or more general purpose hardware processors programmed to perform the techniques pursuant to program instructions in firmware, memory, other storage, or a combination.
- ASICs application-specific integrated circuits
- FPGAs field programmable gate arrays
- Such special-purpose computing devices may also combine custom hard-wired logic, ASICs, or FPGAs with custom programming to accomplish the techniques.
- the special-purpose computing devices may be desktop computer systems, portable computer systems, handheld devices, networking devices or any other device that incorporates hard-wired and/or program logic to implement the techniques.
- FIG. 7 is a block diagram that illustrates a computer system 700 upon which an embodiment of the invention may be implemented.
- Computer system 700 includes a bus 702 or other communication mechanism for communicating information, and a hardware processor 704 coupled with bus 702 for processing information.
- Hardware processor 704 may be, for example, a general purpose microprocessor.
- Computer system 700 also includes a main memory 706 , such as a random access memory (RAM) or other dynamic storage device, coupled to bus 702 for storing information and instructions to be executed by processor 704 .
- Main memory 706 also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor 704 .
- Such instructions when stored in non-transitory storage media accessible to processor 704 , render computer system 700 into a special-purpose machine that is customized to perform the operations specified in the instructions.
- Computer system 700 further includes a read only memory (ROM) 708 or other static storage device coupled to bus 702 for storing static information and instructions for processor 704 .
- ROM read only memory
- a storage device 710 such as a magnetic disk, optical disk, or solid-state drive is provided and coupled to bus 702 for storing information and instructions.
- Computer system 700 may be coupled via bus 702 to a display 712 , such as a cathode ray tube (CRT), for displaying information to a computer user.
- a display 712 such as a cathode ray tube (CRT)
- An input device 714 is coupled to bus 702 for communicating information and command selections to processor 704 .
- cursor control 716 is Another type of user input device
- cursor control 716 such as a mouse, a trackball, or cursor direction keys for communicating direction information and command selections to processor 704 and for controlling cursor movement on display 712 .
- This input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allows the device to specify positions in a plane.
- Computer system 700 may implement the techniques described herein using customized hard-wired logic, one or more ASICs or FPGAs, firmware and/or program logic which in combination with the computer system causes or programs computer system 700 to be a special-purpose machine. According to one embodiment, the techniques herein are performed by computer system 700 in response to processor 704 executing one or more sequences of one or more instructions contained in main memory 706 . Such instructions may be read into main memory 706 from another storage medium, such as storage device 710 . Execution of the sequences of instructions contained in main memory 706 causes processor 704 to perform the process steps described herein. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions.
- Non-volatile media includes, for example, optical disks, magnetic disks, or solid-state drives, such as storage device 710 .
- Volatile media includes dynamic memory, such as main memory 706 .
- storage media include, for example, a floppy disk, a flexible disk, hard disk, solid-state drive, magnetic tape, or any other magnetic data storage medium, a CD-ROM, any other optical data storage medium, any physical medium with patterns of holes, a RAM, a PROM, and EPROM, a FLASH-EPROM, NVRAM, any other memory chip or cartridge.
- Storage media is distinct from but may be used in conjunction with transmission media.
- Transmission media participates in transferring information between storage media.
- transmission media includes coaxial cables, copper wire and fiber optics, including the wires that comprise bus 702 .
- transmission media can also take the form of acoustic or light waves, such as those generated during radio-wave and infra-red data communications.
- Various forms of media may be involved in carrying one or more sequences of one or more instructions to processor 704 for execution.
- the instructions may initially be carried on a magnetic disk or solid-state drive of a remote computer.
- the remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem.
- a modem local to computer system 700 can receive the data on the telephone line and use an infra-red transmitter to convert the data to an infra-red signal.
- An infra-red detector can receive the data carried in the infra-red signal and appropriate circuitry can place the data on bus 702 .
- Bus 702 carries the data to main memory 706 , from which processor 704 retrieves and executes the instructions.
- the instructions received by main memory 706 may optionally be stored on storage device 710 either before or after execution by processor 704 .
- Computer system 700 also includes a communication interface 718 coupled to bus 702 .
- Communication interface 718 provides a two-way data communication coupling to a network link 720 that is connected to a local network 722 .
- communication interface 718 may be an integrated services digital network (ISDN) card, cable modem, satellite modem, or a modem to provide a data communication connection to a corresponding type of telephone line.
- ISDN integrated services digital network
- communication interface 718 may be a local area network (LAN) card to provide a data communication connection to a compatible LAN.
- LAN local area network
- Wireless links may also be implemented.
- communication interface 718 sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.
- Network link 720 typically provides data communication through one or more networks to other data devices.
- network link 720 may provide a connection through local network 722 to a host computer 724 or to data equipment operated by an Internet Service Provider (ISP) 726 .
- ISP 726 in turn provides data communication services through the world wide packet data communication network now commonly referred to as the “Internet” 728 .
- Internet 728 uses electrical, electromagnetic or optical signals that carry digital data streams.
- the signals through the various networks and the signals on network link 720 and through communication interface 718 which carry the digital data to and from computer system 700 , are example forms of transmission media.
- Computer system 700 can send messages and receive data, including program code, through the network(s), network link 720 and communication interface 718 .
- a server 730 might transmit a requested code for an application program through Internet 728 , ISP 726 , local network 722 and communication interface 718 .
- the received code may be executed by processor 704 as it is received, and/or stored in storage device 710 , or other non-volatile storage for later execution.
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Databases & Information Systems (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computational Linguistics (AREA)
- Software Systems (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
- User Interface Of Digital Computer (AREA)
Abstract
Description
- The present invention relates to software and, more specifically, to an application that generates a combined search and graph interface for facilitating investigative searches.
- Investigators perform investigative searches for various entities such as email addresses, social profiles, search engine results, dark web forums, and so on. Each investigative search is typically conducted as a series of searches, where the results of a prior search in the series may be used as the starting point of a subsequent search in the series. There are no limits to how deep or wide the series of searches may become. Consequently, the sheer amount of data obtained during the searches, and the relationships among such data, can be overwhelming to visualize, track and manage.
- In one approach, investigative searches are performed by manually adding nodes to a graph that representing points of interest related to the investigation. As an investigative search expands, graphs generated that represent the search often become extremely large, making the graphs difficult to manage and decipher.
- In another approach, investigative searches are performed by searching through various data sources and manually recording navigational actions as a user branches through different data sources, such as webpages and documents. However, using this type of searching approach lacks visibility and makes it difficult for a user to interact with the search, such as by backtracking and branching from one data source to another.
- Techniques are desired to facilitate investigative searches in a scalable, efficient manner that allows investigators to visualize and interact with a search.
- The approaches described in this section are approaches that could be pursued, but not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated, it should not be assumed that any of the approaches described in this section qualify as prior art merely by virtue of their inclusion in this section.
- In the drawings:
-
FIG. 1 illustrates a combined search and graph interface that may be generated by a mobile or web application, according to an embodiment; -
FIG. 2 illustrates the combined search and graph interface ofFIG. 1 after a search result is selected from the search results, according to an embodiment; -
FIG. 3 illustrates a close up view of the graph fromFIG. 2 , according to an embodiment; -
FIG. 4 illustrates a display of search results that result from initiating a search from a node of the graph shown inFIG. 3 , according to an embodiment; -
FIG. 5 illustrates a combined search and graph interface rendered in response to a user selecting one of the search results shown inFIG. 4 , according to an embodiment; -
FIG. 6 illustrates a display of search results with named entities, according to an embodiment; -
FIG. 7 is a block diagram of a computer system upon which the techniques described herein may be implemented. - In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, that the present invention may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to avoid unnecessarily obscuring the present invention.
- A combined search and graph interface is provided for facilitating investigative searches. As mentioned above, each investigative search may involve a series of distinct searches, where a search result obtained by one search is used as the starting point for a subsequent search. For the purpose of explanation, the first search performed during an investigative search is referred to herein as the level-1 search. Any search initiated from any result of the level-1 search is referred to as a level-2 search. Similarly, any search initiated from any result of a level-2 search is referred to herein as a level-3 search.
- When a user initiates a level-1 search for a target, the combined search and graph interface concurrently displays a set search results for the level-1 search and a graph that includes a first node corresponding to the “target” of the level-1 search. The target of a search may be, for example, the keywords used to perform the search.
- When a user selects a search result from level-1 search results, a second node is added to the graph that represents the selected level-1 search result. To represent a direct relationship between the target of the level-1 search and the selected level-1 search result, the second node is displayed as directly connected to the first node in the graph.
- In the event that the selected level-1 search result corresponds to a data source that is associated with one or more named entities, one or more child nodes that correspond to the one or more named entities are added to the graph. For example, assume that the selected level-1 search result is a user profile that includes four named entities: two email addresses, a user_id, and an IP address. In this example, four child nodes would be added below that second node, one for each of the four named entities extracted from the selected user profile.
- As a user continues searching and selecting search results, nodes that correspond to the user's search result selections are automatically added to the graph. A search can be initiated from any node that exists in the graph. For example, the user may select that node that corresponds to any of the four named entities that were extracted from the selected level-1 search result. When the user selects the node that represents a particular named entity from the selected level-1 search result, a level-2 search can be initiated based on the named entity that corresponds to the selected node. In response to initiating a level-2 search from the selected named entity node, the graph and a set of level-2 search results generated by the search are concurrently displayed in the combined search and graph interface.
- The combined graph and search interface discussed herein provides a simultaneous interleaving of search functionality and graph building. Using the combined interface, a user can interact with search results using the graph and/or the search interface while simultaneously recording the results of their investigation in the graph. Using techniques discussed herein, by tracking specific actions used to conduct an investigative search, the combined interface and associated functionality simplifies an investigation process by automatically recording navigational structure of a search into an easy-to-navigate and digestible graph.
- Referring to
FIG. 1 , it illustrates a combined search and graph interface that may be generated by a mobile or web application. In the combined search and graph interface illustrated inFIG. 1 , a user is presented with asearch bar 102 shown at the top ofFIG. 1 , searchresults display region 108 shown on the left ofFIG. 1 , and agraph display region 110 shown on the right ofFIG. 1 .FIG. 1 also shows adata source selection 106, shown below the search bar and arecord button 104 shown to the left ofsearch bar 102. When a user is preparing to perform a search,data source selection 106 can be used to select a data source for executing the search on. - When the
record button 104 is enabled by a user and a level-1 search is initiated for a target, the searchresults display region 108 is populated with results of the search and a node is automatically added to the graph that represents the target of the search. In the present example, “pimp_alex_91” is the target of the current search. The searchresults display region 108 shows search results corresponding to the search target “pimp_alex_91”. Thegraph display region 110 shows a graph that includes a single node corresponding to “pimp_alex_91”. - Each search result of the search
results display region 108 is displayed with a date and one or more name entities. Each named entity shown for a search result is extracted from a data source that corresponds to the particular search result. For example, the search result titled “hostinguer.com” is associated with the named entities including “Name: alexander cazes”, “Ip: 74.56.48.43”, “Email: pimp_alex_91@hotmail.com” which are extracted from the “hostinguer.com” data source. Details regarding how named entities are extracted from data sources are further discussed herein. - In one embodiment, in response to performing a search, the
graph display region 110 is not automatically populated with nodes for each of the search results. Doing so would cause the graph to become crowded and difficult to decipher. Further, a search may produce hundreds of search results, where only a few of those search results are of interest to the searcher. Thus, instead of automatically populating the graph with nodes for all search results, the user can select to explicitly “add to graph” a search result. Doing so will not only cause a node for that search result item to be added to the graph, but it will also cause a set of child nodes to be added to the graph, where the child nodes correspond to named entities extracted for the selected search result item. - As a user selects different search results from search results display
region 108, the selections made by the user are automatically recorded and visualized in thegraph display region 110. Specifically, when the user clicks on a particular search result in the search results displayregion 108, a node that represents the selected search result is created in thegraph display region 110. When the user selects a named entity or hyperlink, further search is performed based on the selected entity or link and the search results displayregion 108 is repopulated with the results of the further search. As the user selects more search results as the search activities progress, additional nodes are added to thegraph display region 110 along with connectors that indicate relationships between nodes. - For example, upon inspecting the search results for the level-1 search illustrated in
FIG. 1 , the user may select a level-1 search result as the basis for a level-2 search. For the purpose of explanation, it shall be assumed that the user selects the level-1 search result titled “hostinguer.com”. In response, a node is added to thegraph display region 110 to represent the data source “hostinguer.com”, as illustrated inFIG. 2 . In addition, nodes are added to thegraph display region 110 to represent the named entities (e.g. “Ip: 74.56.48.43”) that were extracted from “hostinguer.com”. - The
record button 104 can be used as a mechanism for controlling when user selections from the search results displayregion 108 are automatically added as nodes in the graph. In one embodiment, when therecord button 104 is enabled, selections made from search results displayregion 108 are automatically added as nodes in thegraph display region 110. In one embodiment, when therecord button 104 is disabled, selections made from search results displayregion 108 are not automatically recorded as nodes in thegraph display region 110. In one embodiment, even if therecord button 104 is disabled, a user can manually add nodes to thegraph display region 110 by selecting a search result from the search results displayregion 108 and commanding the interface to explicitly “add to graph” the selected search result. - Referring again to
FIG. 2 , it illustrates the combined search and graph interface ofFIG. 1 when a search result is selected from the search results. In the present example, the data source “hostinguer.com” is selected from the search results by a user. In response to the selection, a node corresponding to the data source “hostinguer.com” is added to the graph. Additionally, because the search result “hostinguer.com” represents a data source and is associated with the named entities including “Name: alexander cazes”, “Ip: 74.56.48.43”, “Email: pimp_alex_91@hotmail.com”, a set of child nodes that correspond to the named entities are added to the graph. - As shown in
FIG. 2 , dotted lines between nodes in the graph may indicate indirect relationships (e.g. “produced the search result”) and the presence of a search result node. For example, the dotted line between the node “pimp_alex_91” and the node “hostinguer.com” indicates that the node “hostinguer.com” is associated with a search result, and that the search result was found based on a search made using the target associated with the parent node, “pimp_alex_91”. On the other hand, solid lines between nodes in the graph may indicate direct relationships (e.g. “contains the named entity”). Thus, the solid line between the node “hostinguer.com” and the node “hotmail.com” indicates that the node“hotmail.com” is a named entity extracted from the data source node “hostinguer.com”. - Initiating a Search from a Node
- In addition to initiating a search using the search bar or by selecting a hyperlink or entity from the search results as discussed with respect to
FIG. 1 andFIG. 2 , a level-(N+1) search can be initiated from any level-N node in a graph to continue an investigation of an entity. Referring toFIG. 3 , it illustrates a close up view of the graph fromFIG. 2 . In the present example, the “Search” function is selected for the node “Alexandre cazes”. As explained above, the “Alexandre cazes” node was a named entity node from the level-1 search result “hostinguer.com”. When the ‘Search’ function is selected for a node, a level-2 search is initiated and the respective level-2 search results are displayed in the search results display area. Additionally, based on the type of entity that is selected for a search, a corresponding data source may automatically selected as a target data source for the level-2 search. A list of data sources may be curated by an administrator for each different type of entity. For example, if a Username entity type is selected for a search, the ‘Social Profiles’ data source is selected as the target data source for executing the search. - Referring to
FIG. 4 , it illustrates a display of the level-2 search results that result from initiating a search from a node of the graph shown inFIG. 3 . In the present example,FIG. 4 displays search results that result from the selection of the “Search” function for the node “Alexandre cazes” as shown inFIG. 3 . The search results show results of the search target “Alexandre cazes” in the target data source “Social Profiles”. - Referring to
FIG. 5 , it illustrates a combined search and graph interface rendered in response to a user selecting one of the search results shown inFIG. 4 . In the present example, the named entity “CazesAlexandre” 502 is selected by a user from the search results. In response, a node that represents the named entity “CazesAlexandre” is automatically added to the graph. The graph shows the node “CazesAlexandre” directly connected to the node “Alexandre cazes”. - When a search is initiated and search results are retrieved from a data source, the resulting content of the search results is scanned for entities such as email addresses, usernames, names, phone numbers, etc. The identified entities are displayed prominently in association with the data sources of the entities in the search results.
- Referring to
FIG. 6 , it illustrates a display of search results with named entities. In the present example, the search result “Untitled” that is represented by the hyperlink “http://pastebin.com/XJqmKp4k” is displayed with the named entities: ‘Marcos’, ‘Aberto Kuselman’, ‘Madison’, ‘Lucy Parsons’, ‘Colin Jenkins’, ‘Barack Obama’, ‘Keith Alexander’, ‘Trump’, ‘andl’. The named entities are extracted from the “Bins” data source using machine learning based techniques. - In some embodiments, in addition to extracting named entities from various data sources, named entities are ranked based on the relevance to the entity being investigated. Relevance scores may be generated that indicate a metric of relevance between a search target and named entity. In one embodiment, entities with higher relevance scores are displayed at the top of the search results to draw more attention. This minimizes the time taken by users to look for these entities in the search results.
- The combined graph and search interface discussed herein provides a simultaneous interleaving of search functionality and graph building. Using the combined interface, a user can interact with search results using the graph and/or the search interface while simultaneously recording the results of their investigation in the graph.
- Previous techniques directed to recording investigations in a graph suffer from building a large graph that includes unnecessary nodes and data points. Such large graphs have marginal utility and become increasingly difficult to manage at some point during a search. Using techniques discussed herein, by tracking specific actions used to conduct an investigative search, the combined interface and associated functionality simplifies an investigation process by automatically recording navigational structure of a search into a graph.
- According to one embodiment, the techniques described herein are implemented by one or more special-purpose computing devices. The special-purpose computing devices may be hard-wired to perform the techniques, or may include digital electronic devices such as one or more application-specific integrated circuits (ASICs) or field programmable gate arrays (FPGAs) that are persistently programmed to perform the techniques, or may include one or more general purpose hardware processors programmed to perform the techniques pursuant to program instructions in firmware, memory, other storage, or a combination. Such special-purpose computing devices may also combine custom hard-wired logic, ASICs, or FPGAs with custom programming to accomplish the techniques. The special-purpose computing devices may be desktop computer systems, portable computer systems, handheld devices, networking devices or any other device that incorporates hard-wired and/or program logic to implement the techniques.
- For example,
FIG. 7 is a block diagram that illustrates acomputer system 700 upon which an embodiment of the invention may be implemented.Computer system 700 includes abus 702 or other communication mechanism for communicating information, and ahardware processor 704 coupled withbus 702 for processing information.Hardware processor 704 may be, for example, a general purpose microprocessor. -
Computer system 700 also includes amain memory 706, such as a random access memory (RAM) or other dynamic storage device, coupled tobus 702 for storing information and instructions to be executed byprocessor 704.Main memory 706 also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed byprocessor 704. Such instructions, when stored in non-transitory storage media accessible toprocessor 704, rendercomputer system 700 into a special-purpose machine that is customized to perform the operations specified in the instructions. -
Computer system 700 further includes a read only memory (ROM) 708 or other static storage device coupled tobus 702 for storing static information and instructions forprocessor 704. Astorage device 710, such as a magnetic disk, optical disk, or solid-state drive is provided and coupled tobus 702 for storing information and instructions. -
Computer system 700 may be coupled viabus 702 to adisplay 712, such as a cathode ray tube (CRT), for displaying information to a computer user. Aninput device 714, including alphanumeric and other keys, is coupled tobus 702 for communicating information and command selections toprocessor 704. Another type of user input device iscursor control 716, such as a mouse, a trackball, or cursor direction keys for communicating direction information and command selections toprocessor 704 and for controlling cursor movement ondisplay 712. This input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allows the device to specify positions in a plane. -
Computer system 700 may implement the techniques described herein using customized hard-wired logic, one or more ASICs or FPGAs, firmware and/or program logic which in combination with the computer system causes orprograms computer system 700 to be a special-purpose machine. According to one embodiment, the techniques herein are performed bycomputer system 700 in response toprocessor 704 executing one or more sequences of one or more instructions contained inmain memory 706. Such instructions may be read intomain memory 706 from another storage medium, such asstorage device 710. Execution of the sequences of instructions contained inmain memory 706 causesprocessor 704 to perform the process steps described herein. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions. - The term “storage media” as used herein refers to any non-transitory media that store data and/or instructions that cause a machine to operate in a specific fashion. Such storage media may comprise non-volatile media and/or volatile media. Non-volatile media includes, for example, optical disks, magnetic disks, or solid-state drives, such as
storage device 710. Volatile media includes dynamic memory, such asmain memory 706. Common forms of storage media include, for example, a floppy disk, a flexible disk, hard disk, solid-state drive, magnetic tape, or any other magnetic data storage medium, a CD-ROM, any other optical data storage medium, any physical medium with patterns of holes, a RAM, a PROM, and EPROM, a FLASH-EPROM, NVRAM, any other memory chip or cartridge. - Storage media is distinct from but may be used in conjunction with transmission media. Transmission media participates in transferring information between storage media. For example, transmission media includes coaxial cables, copper wire and fiber optics, including the wires that comprise
bus 702. Transmission media can also take the form of acoustic or light waves, such as those generated during radio-wave and infra-red data communications. - Various forms of media may be involved in carrying one or more sequences of one or more instructions to
processor 704 for execution. For example, the instructions may initially be carried on a magnetic disk or solid-state drive of a remote computer. The remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local tocomputer system 700 can receive the data on the telephone line and use an infra-red transmitter to convert the data to an infra-red signal. An infra-red detector can receive the data carried in the infra-red signal and appropriate circuitry can place the data onbus 702.Bus 702 carries the data tomain memory 706, from whichprocessor 704 retrieves and executes the instructions. The instructions received bymain memory 706 may optionally be stored onstorage device 710 either before or after execution byprocessor 704. -
Computer system 700 also includes acommunication interface 718 coupled tobus 702.Communication interface 718 provides a two-way data communication coupling to anetwork link 720 that is connected to alocal network 722. For example,communication interface 718 may be an integrated services digital network (ISDN) card, cable modem, satellite modem, or a modem to provide a data communication connection to a corresponding type of telephone line. As another example,communication interface 718 may be a local area network (LAN) card to provide a data communication connection to a compatible LAN. Wireless links may also be implemented. In any such implementation,communication interface 718 sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information. - Network link 720 typically provides data communication through one or more networks to other data devices. For example,
network link 720 may provide a connection throughlocal network 722 to ahost computer 724 or to data equipment operated by an Internet Service Provider (ISP) 726.ISP 726 in turn provides data communication services through the world wide packet data communication network now commonly referred to as the “Internet” 728.Local network 722 andInternet 728 both use electrical, electromagnetic or optical signals that carry digital data streams. The signals through the various networks and the signals onnetwork link 720 and throughcommunication interface 718, which carry the digital data to and fromcomputer system 700, are example forms of transmission media. -
Computer system 700 can send messages and receive data, including program code, through the network(s),network link 720 andcommunication interface 718. In the Internet example, a server 730 might transmit a requested code for an application program throughInternet 728,ISP 726,local network 722 andcommunication interface 718. - The received code may be executed by
processor 704 as it is received, and/or stored instorage device 710, or other non-volatile storage for later execution. - In the foregoing specification, embodiments of the invention have been described with reference to numerous specific details that may vary from implementation to implementation. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense. The sole and exclusive indicator of the scope of the invention, and what is intended by the applicants to be the scope of the invention, is the literal and equivalent scope of the set of claims that issue from this application, in the specific form in which such claims issue, including any subsequent correction.
Claims (16)
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US17/128,651 US20220197915A1 (en) | 2020-12-21 | 2020-12-21 | Dynamic entity visualization of search results |
PCT/US2021/063371 WO2022140119A1 (en) | 2020-12-21 | 2021-12-14 | Dynamic entity visualization of search results |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US17/128,651 US20220197915A1 (en) | 2020-12-21 | 2020-12-21 | Dynamic entity visualization of search results |
Publications (1)
Publication Number | Publication Date |
---|---|
US20220197915A1 true US20220197915A1 (en) | 2022-06-23 |
Family
ID=79831775
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US17/128,651 Abandoned US20220197915A1 (en) | 2020-12-21 | 2020-12-21 | Dynamic entity visualization of search results |
Country Status (2)
Country | Link |
---|---|
US (1) | US20220197915A1 (en) |
WO (1) | WO2022140119A1 (en) |
Family Cites Families (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5911138A (en) * | 1993-06-04 | 1999-06-08 | International Business Machines Corporation | Database search facility having improved user interface |
-
2020
- 2020-12-21 US US17/128,651 patent/US20220197915A1/en not_active Abandoned
-
2021
- 2021-12-14 WO PCT/US2021/063371 patent/WO2022140119A1/en active Application Filing
Also Published As
Publication number | Publication date |
---|---|
WO2022140119A1 (en) | 2022-06-30 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US8356051B2 (en) | Integrated saved search results | |
US9412136B2 (en) | Creation of real-time conversations based on social location information | |
US9665649B2 (en) | Contextual help article provider | |
US20170357731A1 (en) | Taxonomy driven commerce site | |
US8515908B2 (en) | Determining related keywords based on lifestream feeds | |
US8788342B2 (en) | Intelligent feature expansion of online text ads | |
US20150074194A1 (en) | Discussion-topic, social network systems | |
US9892096B2 (en) | Contextual hyperlink insertion | |
US8266139B2 (en) | System and interface for co-located collaborative web search | |
US20120131032A1 (en) | Presenting a search suggestion with a social comments icon | |
US20120203852A1 (en) | Systems and methods for establishing or maintaining a personalized trusted social network | |
US10574616B2 (en) | Processing messages input from a plurality of clients | |
US8495048B2 (en) | Applying user-generated deployment events to a grouping of deployable portlets | |
US20170345053A1 (en) | Slideshows in Search | |
US20100131898A1 (en) | History display apparatus, history display system, history display method, and program | |
US20120084657A1 (en) | Providing content to a user from multiple sources based on interest tag(s) that are included in an interest cloud | |
US20130086079A1 (en) | Graphical user interface for interacting with automatically generated user profiles | |
US20230085932A1 (en) | Method and apparatus for sharing information, storage medium, and electronic device | |
US8583663B1 (en) | System and method for navigating documents | |
US20170359433A1 (en) | Scalable management of composite data collected with varied identifiers | |
US20180341716A1 (en) | Suggested content generation | |
US8914500B1 (en) | Creating a classifier model to determine whether a network user should be added to a list | |
US10628498B2 (en) | Interest-based message-aggregation alteration | |
US10592524B2 (en) | Systems and methods for sharing context among standalone applications | |
CN108491502B (en) | News tracking method, terminal, server and storage medium |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: 4IQ, INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BHAGAVATHA, RAGHAVENDRA;VANDANAPU, PULLESWARARAO NAGA;BROWN, ERIN;SIGNING DATES FROM 20201215 TO 20210106;REEL/FRAME:054850/0291 |
|
AS | Assignment |
Owner name: CONSTELLA INTELLIGENCE, INC., CALIFORNIA Free format text: CHANGE OF NAME;ASSIGNOR:41Q, INC.;REEL/FRAME:058517/0473 Effective date: 20201216 |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: ADVISORY ACTION MAILED |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |
|
AS | Assignment |
Owner name: COMERICA BANK, MICHIGAN Free format text: SECURITY INTEREST;ASSIGNOR:CONSTELLA INTELLIGENCE, INC.;REEL/FRAME:067620/0001 Effective date: 20240604 |